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Abstract 

Levesque introduced a notion of "only knowing", with the goal of capturing certain types 
of nonmonotonic reasoning. Levesque's logic dealt with only the case of a single agent. 
Recently, both Halpern and Lakemeyer independently attempted to extend Levesque's logic 
to the multi-agent case. Although there are a number of similarities in their approaches, there 
are some significant differences. In this paper, we reexamine the notion of only knowing, 
going back to first principles. In the process, we simplify Levesque's completeness proof, 
and point out some problems with the earlier definitions. This leads us to reconsider what 
the properties of only knowing ought to be. We provide an axiom system that captures our 
desiderata, and show that it has a semantics that corresponds to it. The axiom system has 
an added feature of interest: it includes a modal operator for satisfiability, and thus provides 
a complete axiomatization for satisfiability in the logic K45. 



1 Introduction 



Levesque [[T4| introduced a notion of "only knowing", with the goal of capturing 
certain types of nonmonotonic reasoning. In particular, he hoped to capture the type 
of reasoning that says "If all I know is that Tweety is a bird, and that birds typically 
fly, then I can conclude that Tweety flies" .0 Levesque's logic dealt only with the 
case of a single agent. It is clear that in many applications of such nonmonotonic 
reasoning, there are several agents in the picture. For example, it may be the case 
that all Jack knows about Jill is that Jill knows that Tweety is a bird and that birds 
typically fly. Jack may then want to conclude that Jill knows that Tweety flics. 

Recently, each of us [|[ [l^] independently attempted to extend Levesque's logic to 
the multi-agent case. Although there are a number of similarities in the approaches, 
there are some significant differences. In this paper, we reexamine the notion of only 
knowing, going back to first principles. In the process, we point out some problems 
with both of the earlier definitions. This leads us to consider what the properties 
of only knowing ought to be. We provide an axiom system that captures all our 
desiderata, and show that it has a semantics that corresponds to it. The axiom 
system has an added feature of interest: it involves enriching the language with a 
modal operator for satisfiability, and thus provides an axiomatization for satisfiability 
in K45. Unfortunately, the semantics corresponding to this axiomatization is not as 
natural as we might like. It remains an open question whether there is a natural 
semantics for only knowing that corresponds to this axiomatization. 

The rest of this paper is organized as follows. In the next section, we review 
the basic ideas of Levesque's logic and provide an alternative semantics. The use of 
the alternative semantics leads to a simplification of Levesque's completeness proof. 
In Section we review Lakemeyer's approach, which we call the canonical-model 
approach, and discuss some of its strengths and weaknesses. In Section [|, we go 
through the same process for Halpern's approach. In Section ^, we consider our new 
approach. Much of the discussion in Sections ||, f|, and || is carried out in terms of 
three critical properties of Levesque's approach which we cull out in Section |[ In 
particular, we examine to what extent each of the approaches satisfies these properties. 
In Section^, we show how the logic can be used, and discuss its relationship to Moore's 
autoepistemic logic jl5[| . Levesque showed that the single-agent version of his logic of 
only knowing was closely connected to autoepistemic logic. We extend his result to 
the multi-agent case. We conclude in Section (7) with some discussion of only knowing. 

2 Levesque's Logic of Only Knowing 

We begin by reconsidering Levesque's definition. Let $ be a set of primitive propo- 
sitions. Let OAf£(Q) be a prepositional modal language formed by starting with 
the primitive propositions in and closing off under the classical operators -1 and 
V and two modalities, L and N. We omit the $ whenever it is clear from context 
or not relevant to the discussion. We freely use other connectives like A, =>, and 
as syntactic abbreviations of the usual kind. In addition, we take Oct to be an 

lr The reader should feel free to substitute "believe" anywhere we say "know". Indeed, the formal 
logic that we use, which is based on the modal logic K45, is more typically viewed as a logic of belief 
rather than knowledge. 
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abbreviation for La A N^a. Here La should be read as "the agent knows or believes 
(at least) a" , Na should be read as "the agent believes at most -ia" (so that N—>a is 
"the agent believes at most a" ) and Oa should be read as "the agent knows only a" . 
We define an objective formula to be a propositional formula (i.e., a formula with no 
modal operators), a subjective formula to be a Boolean combination of formulas of 
the form Lip or Nip, and a basic formula to be a formula which does not mention N. 

Levesque gave semantics to knowing and only knowing using the standard possible- 
worlds approach. In the single-agent case, we can identify a situation with a pair 
(W, w), where w is a possible world (represented as a truth assignment to the primitive 
propositions) and W consists of a set of possible worlds. Intuitively, W is the set of 
worlds which the agent considers (epistemically) possible, and w describes the real 
world. We do not require that w G W or that W ^ 0.0 As usual, we say that the 
agent knows (at least) a if a is true in all the worlds that the agent considers possible. 
Formally, the semantics of the modality L and the classical connectives is given as 
follows. 

(W, w) \= p if w \= p if p is a primitive proposition. 
(W,w) |=-.aif (W,w)\£a. 
(W, w) \= a V (3 if (W, w) \= a or (W, w) \= f3. 
(W, w) \= La if {W, w') \= a for all w' G W. 
Notice that if La holds, then the agent may know more than a. For example, Lp 
does not preclude L{pf\q) from holding. This is why we should think of La as saying 
that the agent knows at least a. 

It is well-known that this logic is characterized by the axiom system K45. For 
convenience, we describe K45 here: 

Axioms: 

P. All instances of axioms of propositional logic. 

K. (Lip AL(p => ip)) => Lip. 

4. Lip => LLtp. 

5. -iLip =>■ L-iLip. 

Inference Rules: 

Rl. From ip and ip =>• ip infer tp. 
R2. From ip infer Lip. 

The axioms 4 and 5 are called the positive introspection axiom and negative intro- 
spection axiom, respectively. They are appropriate for agents that are sufficiently 
introspective so that they know what they know and do not know. 

How do we give precise semantics to Nl That is, when should we say that (W, w) \= 
Nj37 Intuitively, Nj3 is true if j3 is true at all the worlds that the agent does not 
consider possible. It seems fairly clear from the intuition that we need to evaluate 
the truth of f3 in worlds w' £ since these are the worlds that the agent considers 
impossible in (W, w). But if j3 is a complicated formula involving nested L operators, 
then we cannot simply evaluate the truth of (3 at a world w' . We need to have a set 
of worlds too. In fact, the set of possible worlds we use is still W. That is, while 

2 By requiring that W is nonempty, we get the modal logic KD45; by requiring that w E W , we 
get S5. 

3 Note that, since we defined worlds extensionally as truth assignments, the set of impossible 
worlds is well-defined and fixed for a given W . 
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evaluating the truth of j3 in the impossible worlds, the agent keeps the set of worlds 
he considers possible fixed. Formally, we define 

(W, w) \= Na if (W, w') \= a for all w' <£ W. 

Let us stress three important features of this definition. 

• First, as we have already observed, the set of possibilities is kept fixed when we 
evaluate Na. 

• Second, the set of conceivable worlds — the union of the set of "possible" worlds 
considered when evaluating L and the set of "impossible" worlds considered 
when evaluating N — is fixed, independent of the situation (W,w); it is always 
the set of all truth assignments. 

• Finally, for every set of conceivable worlds, there is a model where that set is 
precisely the set of worlds that the agent considers possible. 

Roughly speaking, the first property is what is required for A4, while the second 
property is what is required for A5. The intent of the third property is to make it 
possible that any objective formula can be "all you know." As we shall see in Section|5[ 
in a precise sense, the third property is somewhat stronger than we actually need. All 
we really need is that for any objective formulas the set of all worlds satisfying these 
formulas can be considered possible. We return to these properties for guidance when 
we discuss possible ways of extending Levesque's semantics to the multi-agent case. 

Since Oa is an abbreviation for La A N->a, we have that 

(W, w) \= Oa if for all worlds w', w' G W iff (W, w') \= a. 

As it stands, the semantics has the somewhat odd property that there are situa- 
tions that agree on all basic beliefs yet disagree on what is only believed. As pointed 
out by Levesque Jbij , the problem is that there are far too many sets of worlds than 
there are basic belief sets. In order to find a perfect match between the sets of ba- 
sic beliefs an agent may hold and sets of worlds, Levesque introduces what he calls 
maximal sets of worlds. In essence, a maximal set is the largest set in the sense that 
adding any other world to it would change the agent's basic beliefs. Furthermore, 
every set of worlds can be extended to a unique maximal set of worlds. It is well 
known that in the logic K45, an agent's beliefs are completely determined by his be- 
liefs about objective formulas (see, for example, || for a proof). Thus, we define a 
maximal set as follows: 

Definition 2.1 If W is a set of worlds, let 

W + = {w | for all objective formulas ip, if (W,w)\=Lip then (W, w)^<p}. 

W is called maximal iff W = W + . 

Levesque defines validity and satisfiability with respect to maximal sets only. In 
particular, a formula a is valid iff for every maximal set of worlds W and every world 
w e W, we have (W, w)\=a. 

We end this review of Levesque's logic by presenting (a slight variant of) his proof 
theory. 
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Axioms: 

Al. All instances of axioms of propositional logic. 

A2. L(a=> (3) (La^ Lj3). 

A3. N(a => (3) => {Na N(3). 

A4. a =>• La A Na for every subjective formula a. 

A5. Na => —iLo. if ->ot is a propositionally consistent objective formula. 

Inference Rules: 

MP. From a and a => (3 infer (3. 
Nec. From a infer La and TVa. 

Axioms A2-A4 tell us that that L and N separately have all the properties of K45- 
operators. Actually, A4 tells us more; it says that L and N are mutually introspective, 
so that, for example, L(p NL(p is valid. Perhaps the most interesting axiom is A5, 
which gives only-knowing its desired properties. Its soundness depends on the fact 
that the union of the set of worlds considered when evaluating L and the set of worlds 
considered when evaluating N is the set of all conceivable worlds.^ 

Theorem 2.2 Jl4| If $ is infinite, then Levesque's axiomatization is sound and com- 
plete for the language OAf£(Q) with respect to Levesque's semantics. 

As we shall see, the assumption that there are infinitely many primitive proposi- 
tions in <I> is crucial for Levesque's completeness result. Extra axioms are required if 
$ is finite. In addition, it is interesting to note that the assumption that L and N are 
interpreted with respect to complementary sets of worlds is not forced by the axioms. 
In particular, for the soundness of Axiom A5, it suffices that the sets considered for 
L and N cover all conceivable worlds; they may overlap. The following semantics 
makes this precise. 

Define an extended situation to be a triple (Wl, Wn, w), where Wl and Wn are 
sets of worlds (truth assignments) such that WlUWn consists of all truth assignments. 
Define a new satisfaction relation \= x that is exactly like Levesque's except for L- and 
N- formulas. For them, we have 

(W L ,W N ,w) \= x La if (W L ,W N ,w') \= x a for all w' E W L 
(W L , Wn, w) \= x Na if (W L , W N , w') ^ x a for all w' £ W N . 
Note that L and N are now treated in a completely symmetric way. 

Theorem 2.3 For all $, Levesque's axiomatization is sound and complete for the 
language OJ\fC(§) with respect to ^ x . 



Proof We omit the soundness proof, which is straightforward. Note that for axiom 
A5 to be sound it suffices that Wl and Wn together cover all worlds. In particular, 
it does not matter whether or not the two sets overlap. 

To prove completeness, we use the notion of a maximal consistent set. Given an 
arbitrary axiom system AX, we say that a formula (p is consistent with respect to AX 

4 Note that, while unusual, the axiom schema A5 is recursive, since consistency of formulas in 
classical propositional logic is decidable. Hence the axioms themselves are recursive. As noted in |14| , 
this is a problem in the first-order case, however. In fact, Levesque's proof theory for the first-order 
version of his logic was recently shown to be incomplete M . 



4 



if it is not the case that AX I — up, where, as usual, we use h to denote provability. A 
finite set of formulas ipi, . . . , </?„ is consistent with respect to AX if the conjunction 
<piA...A(p n is consistent with respect to AX. An infinite set of formulas is consistent 
with respect to AX if every finite subset of its formulas is consistent with respect to 
AX. Finally, given a set F of formulas, a maximal consistent subset of F is a subset 
F' of F which is consistent with respect to AX such that any superset of F 1 is not 
consistent with respect to AX. 

In the following, provability, consistency, and maximal consistency all refer to 
Levesque's axiom system unless stated otherwise. To prove completeness we show 
that every consistent formula is satisfiable with respect to \= x , using a standard 
canonical model construction |l(| . 

Let To be the set of all maximal consistent sets of formulas in ON£($). For 
9 £ r , define 9/L = {a | La £ 9} and 6/N = {a\Na£ 9}. We then define 

. r£ = {9' e To | 9/L C 9'}, 

. T% = {9' G T | 9/N C 9'}. 

If we view maximal consistent sets as worlds, then T e L and T 9 N represent the worlds 
accessible from 9 for L and N, respectively. The following lemma reflects the fact 
that L and N are both fully and mutually introspective (axiom A4). 

Lemma 2.4 If 6' E T e L l)T e N , then T% = T e L and T e N =T%. 

Proof We prove the lemma for 9' eT'. The case 9' £ T e N is completely symmetric. 
To show that T e L = T 9 ^, it clearly suffices to show that 9/L = 9'/L. Let a £ 9/L. 
Then La £ 9 and also LLa £ 9 by axiom A4. Thus La £ 9' (since 9' £ T e L implies 
that 9/L C 9') and, hence, a £ 9'/L. 

For the converse, let a £ 9'/L. Thus, La £ 9'. Assume that a ^ 9/L. Then 
->La £ 9 (since 9 is a maximal consistent set) and, therefore, L->La £ 9, from which 
-iLa £ 9' follows, a contradiction. 

The proof that T e N = T e N proceeds the same way, that is, we show that 9/N — 
9'/N. Let a £ 9/N. Then Na £ 9 and also LNa £ 9 by axiom A4. Hence Na £ 9', 
so a £ ff/N. 

For the converse, let a £ O'/N. Thus, JVq £ 9'. Assume that a g' 9/N. Then 
-liVa £ 9 and also L^Na £ 9, from which -*Na £ 9' follows, a contradiction. 

In traditional completeness proofs using maximal consistent sets (see, for example, 
[PI 0)' a situation is constructed whose worlds consists of all maximal consistent sets. 
Here, we must be a little more careful. 

We say that a maximal consistent set 9 contains a truth assignment w if for all 
atomic formulas p, we have w \= p iff p £ 9. Clearly a maximal consistent set 9 contains 
exactly one world; we denote this world by wg. For 9 £ T , let W[ = {we 1 \ 9' £ T L } 
and W e N = {wg, | 9' £ T e N }. 

Lemma 2.5 (a) (W[, W^, wg) is an extended situation, 
(b) For all a, we have a € 6 iff (W[, W e N , w e ) h x a. 
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Proof For part (a), to show that (W[,W^,we) is an extended situation, we must 
show that Wl U Wfj consists of all truth assignments. By way of contradiction, 
suppose there is a truth assignment w not in W[ U Wjy. Let F w = {p e $ | w \= 
p} U {^p | p £ $, w |= -ip}. F w U 9/L cannot be consistent, for otherwise there 
would be some 9' € T e L that contains F w , which would mean that w € W^. Similarly 
F w U 8/N cannot be consistent. Thus, there must be formulas (pi, tp2, <f3, <P4 such 
that ipi and tp2 are both conjunctions of a finite number of formulas in F w , (p3 is 
the conjunction of a finite number of formulas in 9/L, and ip4 is the conjunction of 
a finite number of formulas in 9/N, and both <p\ A p>3 and p>2 A ip^ are inconsistent. 
Thus, we have h ^3 -xpi and h ip^ ~"P2- Using standard modal reasoning 
(A2, A3, and Nec), we have h L(p3 => L^p\ and Nip^ => N^tp 2 - Since Lip £ 9 for 
each conjunct tp of tf3, standard modal reasoning shows that Lips 6 9. Similarly, we 
have Nipi £ 9. Since 9 is a maximal consistent set, both L-xpi and N-np2 are in 9. 
Since h L^ipi =4> L(-«pi V -'932) and h N^ip2 =>■ N(-^(pi V _i v?2), it follows that both 
L(-i</?i V _i </'2) and N(-*(pi V _i </'2) are in 0. But this contradicts A5, since 951 A </?2 is 
a propositionally consistent objective formula. 

For part (b), the proof proceeds by induction on the structure of a. The statement 
holds trivially for atomic propositions, conjunctions, and negations. In the case of 
La, we proceed by the following chain of equivalences: 
Lae9' 

iff for all 6' e T 6 L , we have a £ 9' 

iff for all 9' we have (W[ , , wg>) \= x a (using the induction hypothesis) 

iff for all w e > £ W[, we have (W[,W^, we>) \= x a (by Lemma 
iff {W e L ,W e N ,w e )\= x La. 
The case Na is completely symmetric. 

The completeness result now follows easily. Let a be a consistent formula and 9 a 



maximal consistent set of formulas containing a. By Lemma 2.5, (W^, W^, wg) \= x a. 



Levesque considered only maximal sets in his definition of validity. In fact, this 
restriction has no effect on the notion of validity. 

Corollary 2.6 A formula a e CW"£($) is valid iff (W, w) \= a for all situations 
( W, w) (including nonmaximal W) . 

Proof If $ is finite, it is easy to check that W + = W for all sets W, so the result 
is trivially true if $ is finite. So suppose $ is infinite. Notice that each situation 
(W, w) corresponds to an extended situation (Wl, Wn, w), where Wl = W and Wn 
is the complement of W. Let us call such an (Wl, Wn,w) an extended complemen- 



tary situation. Theorems 2.2 and 2.3 together imply the valid formulas obtained when 
considering all extended situations remain the same when we restrict ourselves to com- 
plementary situations with maximal Wl- The corollary then follows from the fact 
that the set of all extended situations properly includes the set of all extended com- 
plementary situations, which in turn includes the set of all extended complementary 
situations with maximal Wl- 



As Theorem 2.3 shows, for the \= x semantics, Levesque's axioms are sound and 



complete for all sets $ of primitive propositions. On the other hand, as we said earlier, 
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Levesque's completeness proof (with respect to his semantics) depends crucially on 
the fact that $ is infinite. If $ is finite, Levesque's axioms are still sound with respect 
to his semantics, but they are no longer complete. For example, if <I> = {p}, then 
—iL-ip =>■ N~ip would be valid under |=; this does not follow from the axioms given 
above. In fact, for each finite set <E> of primitive propositions, we can find a new axiom 
scheme that, taken together with the previous axioms, gives a complete axiomatization 
for OAf£(Q) for Levesque's semantics if $ is finite.^ The new axiom, which subsumes 
axiom A5, allows us to reduce formulas involving N formulas involving only L. 

Note that worlds, which are truth assignments to the primitive propositions <E>, are 
themselves finite if $ is finite. Hence we can identify a world w with the conjunction 
of all literals over <!> that are true at w. For example, if <I> = {p, q} and w makes p 
true and q false, then we identify w with p A ->q. For any objective formula a, let 
W a ,$ be the set of all worlds (over the primitive propositions <&) that satisfy a. The 
axiom system AX$ is then obtained from Levesque's system by replacing A5 by the 
following axiom: 

A5$. Na = /\ W £ W -iL-iw if —>a is a propositionally consistent objective formula. 
The axiom is easily seen to be sound since it merely expresses that Na holds at W 
just in case W contains all worlds that satisfy -ia. Note that this property depends 
only on the fact that L and N are defined with respect to complementary sets of 
worlds and, hence, also holds in the case of infinite <&. However, it is only in the 
finite case that we can express this axiomatically. Completeness is also very easy to 
establish. Levesquc |w| showed that in his system, even without A5, every formula 
is provably equivalent to one without nested modalities. With A5$, we then obtain 
an equivalent formula that does not mention N. In other words, given a formula 
consistent with respect to AX$ , a satisfying model can be constructed with the usual 
technique for KAh alone. 

Theorem 2.7 AX$ is sound and complete for the language ON£(Q) with respect 
to Levesque's semantics, if $ is finite. 

3 The Canonical-Model Approach 

How do we extend our intuitions about only knowing to the multi-agent case? First we 
extend the language OJ\fC(<&) to the case of many agents. That is, we now consider a 
language OA/"£„($), which is just like ONC except that there are modalities Li and 
Ni for each agent i, 1 < i < n, for some fixed n. In the remainder of the paper, we 
omit the <&, just writing ONC and ONC n , since the set of primitive propositions does 
not play a significant role. By analogy with the single-agent case, we call a formula 
basic if it does not mention any of the operators Ni (i = 1, . . . , n) and i- subjective 
if it is a Boolean combination of formulas of the form Li<p and Ni<p. What should 
be the analogue of an objective formula? It clearly is more than just a propositional 
formula. From agent l's point of view, a formula like L^p or even LiL\p is just as 
"objective" as a propositional formula. We define a formula to be i- objective if it is 
a Boolean combination of primitive propositions and formulas of the form Ljip and 

5 This was also the situation for the logic considered in Ji|. In that paper, a simple axiomatization 
was provided for the case where <3? was infinite; for each finite $, an extra axiom was needed (that 
depended on 
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Njip, j ^ i, where <p is arbitrary. Thus, qAN^Lip is 1-objective, but Lip and ql\L\p 
are not. The i-objective formulas true at a world can be thought of as characterizing 
what is true apart from agent i's subjective knowledge of the world. 

The standard model here is to have a Kripke structure with worlds and accessi- 
bility relations that describe what worlds the agents consider possible in each world. 
Formally, a (Kripke) structure or model is a tuple M — (W, 7r, K\, . . . , /C n ), where W 
is a set of worlds,^] tt associates with each world a truth assignment to the primitive 
propositions, and /Q is agent i's accessibility relation. Given such a Kripke structure 
M, let ICfiw) = {w 1 : (w,w') G /Cj{] K.f{w) is the set of worlds that agent i 
considers possible at w in structure M. As usual, we define 

(M, w) \= Ua if (M, w') \= a for all w' G K.f{w). 

We focus on structures where the accessibility relations are Euclidean and transitive, 
where a relation R on W is Euclidean if (u, v) G R and (it, w) G R implies that 
(v,w) G R, and i? is transitive if (tt, v) G R and (w,w) G R implies that (u,w) G R. 
We call such structures K45„-structures. It is well known g, ||] that these assumptions 
are precisely what is required to get belief to obey the K45 axioms (generalized to n 
agents). We say that a formula consistent with these axioms is K45„-consistent. An 
infinite set of formulas is said to be K45„-consistent if the conjunction of the formulas 
in every one of its finite subsets is K45„-consistent. 

Now the question is how to define the modal operator JVj. The problem in the 
multi-agent case is that we can no longer identify a possible world with a truth 
assignment. In the single-agent case, knowing the set of truth assignments that the 
agent considers possible completely determines his knowledge. This is no longer true 
in the multi-agent case. Somehow we must take the accessibility relations into account. 
A general semantics for an A-like operator was first given by Humberstone jllj and 
later by Ben-David and Gafni [|J. In this approach, the semantics of N is given as 
follows: 

(M, w) \= N t a if (M, w') \= a for all w' G W - K,f{w). 

The problem with this definition is that it misses out on the intuition that when 
evaluating A^a, we keep the set of worlds that agent i considers possible fixed. If 
w' G W — ICf 1 (w), there is certainly no reason to believe that /Cf f (u>) = Kf l {w'). 

One approach to solving this problem is as follows: If w and w' are two worlds 
in M, we write w ~j w' if ICf^w) — £f f (u/), i.e., if w and w' agree on the possible 
worlds according to agent i. We then define 

(M, w) \= N t a if (M, w') \= a for all w' such that w' G W - ICf'^w) and w «. ( w' . 

While this definition does capture the first of Levesque's properties, it does not 
capture the second. To see the problem, suppose we have only one agent and a 
structure M with only one possible world w. Suppose that (w, w) G ICf 1 and p is 
true at w. Then it is easy to see that (M, w) \= L\p A Nip, contradicting axiom 
A5. The problem is that since the structure has only one world and it is in JCf 1 (w), 

6 Note that here W denotes the set of all worlds of the particular model M, not just the (epis- 
temically) possible ones as in Levesque's logic. 

7 We use the superscript M since we shall later need to talk about the /Q relations in more than 
one model at the same time. 
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there are no worlds in W — K.±(w). Thus, N%p is vacuously true. Intuitively, there 
just aren't enough "impossible" worlds in this case; the set of conceivable worlds is 
not independent of the model. To deal with this problem, we focus attention on one 
particular model, the canonical model, which intuitively has "enough" worlds. Its 
worlds consist of all the maximal consistent subsets of basic fo rmu las. (Recall that 



maximal consistent sets were defined in the proof of Theorem 2.3.) Thus, in some 
sense, the canonical model has as many worlds as possible. 

Definition 3.1 The canonical model (for K45 ra ) M c = (W c , ir c , KL\ , . . . , /C£) is de- 
fined as follows: 

• W c = {w | w is a maximal consistent set of basic formulas with respect to K45„} 

• for all primitive propositions p and w G W c , ■k{w){p) = true iff p G w, 

• (w,w') € K,\ i&w/Li C w' , where w/Li — {a \ Lia G w}. 

Validity in the canonical-model approach is defined with respect to the canonical 
model only. More precisely, a formula a is said to be valid in the canonical-model 
approach, denoted |= c a, iff M c \=a, that is, if for all worlds w in the canonical model 
we have (M c , w)\=a. 

We clearly cannot use the canonical model in a practical way. It can be shown 
that it has uncountably many worlds. Each of its worlds is characterized by an infinite 
set of formulas, so cannot be described easily. Moreover, in general, both fC1(w) and 
W c — K>1(w) are infinite, so we cannot compute whether Liip or Niip holds at a given 
world. Thus, our interest in the canonical model is mainly to understand whether it 
gives reasonable semantics to the iV, operator. 

We start by arguing that, for an appropriate notion of "possibility" and "conceiv- 
ability" , this semantics satisfies the first two of Levesque's properties. What then is 
a conceivable world? Intuitively, it is an objective state of affairs from agent i's point 
of view, which does not include i's beliefs. In the single-agent case, this is simply a 
truth assignment. In the multi-agent case, things are more complicated, since beliefs 
of other agents are also part of i's objective world. One way of characterizing a state 
of affairs from i's point of view is by the set of i-objective formulas that are true at 
a particular world. For technical reasons, in this section we restrict even further to 
the i-objective basic formulas — that is, those formulas that do not mention any of the 
modal operators Nj, j = 1, . . . , n — that are true. If we assume that the basic formulas 
determine all the other formulas, which can be shown to be true in the single-agent 
case, and under this semantics for the multi-agent case, then it is arguably reasonable 
to restrict to basic formulas. However, as we shall see in Section ||, it is not clear that 
this restriction is appropriate, although we make it for now. 

Definition 3.2 Given a situation (M, w), let objijM, w) consist of all the i-objective 
basic formulas that are true at (M, w). let Obj j (M, w) — {obj^M, w') \ w' £ K,\ l (w)}, 
and let subj^ (M, w) = {basic Lia \ (M, w)\=Lia} U {basic -iL^a | (M, w)\£LiOi}. 

We take obj^M^w) to be i's state at (M, w). Notice that obj^M^w) is a maximal 
consistent set of i-objective basic formulas. For ease of exposition, we say i-set from 
now on rather than "maximal set of i-objective basic formulas". Thus, the set of 
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conceivable states for agent i is the set of all i-sets. Notice that the set of conceivable 
states is independent of the model. It is easy to show that this is a generalization of 
the single-agent case, since in the single-agent case the «-objective basic formulas are 
just the propositional formulas, and an i-set can be identified with a truth assignment. 

Obji(M, w) is the set of i-sets that agent i considers possible in situation (M, w); 
subj^M, w) characterizes i's basic beliefs in (M, w). Notice that if a is an i-objective 
basic formula, then L^a £ subji(M,w) iff a is in every i-set in Obj^M^w). 

With these definitions, we can show that the first two of Levesque's properties 
hold in the canonical model. The first property says that at all worlds w' considered 
in evaluating a formula of the form Ni<p at a world w, the set of possible states — that 
is, the set {obj i (M c ,w") | w" £ /Q(u>')} — is the same for all w' G IC[(w). This is easy 
to see, since the only worlds w' we consider are those such that K.f(w') — Kf(w). The 
second property says that the union of the set of states associated with the worlds 
used in computing L,- ip at w and the set of states associated with the worlds used in 
computing N%<p at w should consist of all conceivable states. To show this, we must 
show that for every world w in the canonical model, the set {o6j i (M c , w') \ w' «j w} 
consists of all i-sets. 

To prove this, we need two preliminary lemmas. 

Lemma 3.3 Let w and w' be worlds in M c . Then w «j w' iff agent i has the same 
basic beliefs at w and w' , that is, subj i (M c ,w) — subj^M ,w'). 

Proof The "only if" direction is immediate because w and w' are assumed to have 
the same /Ci-accessible worlds. To prove the "if" direction, suppose that subj^M , w) — 
subj i (M c ,w') but w qki w' . Without loss of generality, there is a world w* 6 
JC1(w) — K,1(w'). By the definition of the canonical model, there must be a basic 
formula L^a G w' such that a ^ w* . By assumption, Lia € w, contradicting the 
assumption that w* € JC^(w). 



Lemma 3.4 Suppose T consists only of i-objective basic formulas, S consists only 
of i-subjective basic formulas, and T and E are both K45„-consistent. Then V U E is 
K45„-consistent . 



Proof This follows immediately from part (c) of Proposition 4.2 below. 

We can now prove that the set of conceivable states for agent i is the same at all 
worlds of the canonical model. This follows from the following result. 

Theorem 3.5 Let w g W c . Then for every i-set T there is exactly one world w* 
such that obj^M , w*) — T and w « l w*. 



Proof Let E = subj i (M c ,w). Since T consists of i-objective basic formulas only, E 
consists of i-subjective formulas, and T and E are both K45„-consistent, by Lemma 3.4, 
r U E is K45„-consistent. Let w* be a maximal consistent set that contains T U E. 



Since w and w* agree on E, w R*j w* by Lemma 3.3. The uniqueness of w* follows 
by a simple induction argument. 
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What about the third property? This says that every subset of i-sets arises as the 
set of i-sets associated with the worlds that i considers possible in some situation; 
that is, for every set S of i-sets, there should be some situation (M c , w) such that S = 
Obj i (M c ,w). As we now show, this property does not hold in the canonical model. 
We do this by showing that the set of i-sets associated with the worlds considered 
possible in any situation in the canonical model all have a particular property wc call 
limit closure^ 

Definition 3.6 We say that an i-set T is a limit of a set S of i-sets if, for every finite 
subset A of T, there is a set feS such that Acf. A set S of i-sets is limit closed 
if every limit of S is in S. 

Lemma 3.7 For every world w in M c , the set Obj i (M c , w) is limit closed. 

Proof Let w be a world in the canonical model and let T be an i-set which is a limit 
of Obj^M", w). We want to show that T £ Obj i {M c , w). Let E = {basic (3 \ Li/3 £ w}. 
We claim that ruE is K45 n -consistent. For suppose not. Then there must be a finite 
subset ACT such that AuE is inconsistent. Since T is a limit of Obj i (M c , w), there 
must be some world w' in Obj i (M c ,w) such that (M c ,w') |= A. By construction of 
the canonical model, since w' £ Kf(w), we must have that (M c , w') \= E. Thus AuE 
is consistent, contradicting our assumption. 

Since r U E is consistent, there is a world w* in the canonical model such that 
(M c ,w*) ^ TUE. Clearly T = obj i (M c ,w*). Moreover, by construction, we must 
have w* £ lC?(w). Thus, T £ Obj t (M c ,w), as desired. 

Since there are clearly sets of i-sets that are not limit closed, it follows that this 
semantics does not satisfy the third property. One consequence of this is a result 
already proved in |l2| ], which we reprove here, using an approach that will be useful 
for later results. 

Proposition 3.8 JlJ] If p £ $ and i ^ j, then \= c ^Oi^Ojp. 

Proof We proceed by contradiction. Our goal is to show that if (M c , w) \= Oi^Ojp, 
then the set Obj i (M c , w) must contain a set that includes Ojp, for otherwise it would 
not be limit closed. It follows that there is some world v £ K,1(w) such that (M c , v) \= 
Ojp, contradicting the assumption that (M c ,w) \= Li~>Ojp. 

We first need a definition and a lemma. We say that a basic formula ip is (K45)- 
independent of a basic formula ip if neither ^K45„ <p =>■ ip nor ^K45„ <f ~<ip hold. 

Lemma 3.9 If n > 2 (i.e., there are at least two agents) and ipi, . . . , ip m are consistent 
basic i-objcctivc formulas, then there exists a basic i-objective formula iji of the form 
Ljip' which is independent of each of (p±, . . . , ip m . 

Proof Define the depth of a basic formula ip, denoted d((p), inductively: 

8 This turns out to be closely related to the limit closure property discussed in g|; a detailed 
comparison would take us too far afield here though. 
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• d(p) = for a primitive proposition p, 



• d(<p A ip) = max(d(<p), d(ip)), 

• d(-*p) = d(<p), 

• d{Li<p) = 1 + d(tp). 

Suppose that ipx, . . . , (p m are i-objective formulas such that max(d((/?i(, . . . , d(ipk)) — 
K. Let p be an arbitrary primitive proposition, and suppose j ^ i. (Such a j exists, 
since we are assuming n > 2.) Let ip be the formula (LjLi) K+1 p, where by (LjLi) K+1 
we mean K + 1 occurrences of LjLi. Standard model theoretic arguments show that 
V> is independent of ipi, ... , ip m . Very briefly: By results of j^], we know that tpi is 
satisfiable in a treelike structure of depth at most d(ipi), for i = 1, . . . , m. It is easy 
to see that this can be extended to two structures, one of which satisfies ip, and the 
other of which satisfies —op. Hence, ip is independent of ipi. 

Continuing with the proof of Proposition [3.g| , suppose by way of contradiction 
that (M c ,w) \= Oi^Ojp. Let w be a world such that (M c , w)\=Ojp and let T = 
obj^M ,w). We claim that T is a limit of 06j,j(Af c ,w). To see this, consider any 
finite subset A of T. Let ip be an i-objective basic formula of the form Ljtp' which 
is independent both of the conjunction of the formulas in A and of p. The existence 



of such a formula follows from Lemma 3.9. Let S = subj i (M c ,w). By Lemma 3.4 
EU AU{LjV'} is consistent. Thus, there is some world w' € W c such that (M c , w') p 
EU AU {Ljtp'}. By Lemma [TJ again, there is some world w" satisfying p A ^Ljip' 
such that w" Wj w'. Since (M c ,u>') |= Lj^'j we cannot have w" G )Cj(w'). It follows 
that (M c ,u>') |= ^Nj^p, and hence (M c ,u/) |= ^Ojp. Moreover, since w' and w 
agree on all i-subjective formulas, the canonical model construction guarantees that 
w' w. Since (M c ,w) |= Oi^Ojp , (Af c ,w') |= ^Ojp, and w' w, we must have 
that u/ e K.1{w). Thus, obj i (M c ,w') £ Obj i (M c ,w). Moreover, by construction, 
A C obj i (M c ,w'). Since A was chosen arbitrarily, it follows that T is a limit of 



06j i (M c , By Lemma 3.7, L £ Obj^M ,w). Thus, there is some world v 6 K-1{w) 
such that o6j i (M c ,w) = T. It is a simple property of the canonical-model approach 
that two worlds that agree on all basic beliefs of an agent also agree on what the 
agent only believes. Hence, since w and v agree on j's basic beliefs, it follows that 
(M°,v)\=Ojp, contradicting the assumption that (M c , w)\=Oi^Ojp. 

It may seem unreasonable that ->Oi~'Ojp should be valid in the canonical-model 
approach. Why should it be impossible for i to know only that j does not only know 
pi After all, j can (truthfully) tell i that it is not the case that all he (j) knows is p. 
We return to this issue in Sections [| and |[ For now, we focus on a proof theory for 
this semantics. 



3.1 A Proof Theory 

We now consider an axiomatization for the language. The following axiomatization is 
exactly like Levesque's except that axiom A5 now requires K45„-consistency instead 
of merely propositional consistency. For ease of exposition, we use the same names 
for the axioms as we did in the single-agent case with a subscript n to emphasize that 
we are looking at the multi-agent version. 
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Axioms: 



Al n . Axioms of prepositional logic. 

A2„. Li(a => 13) =^ {L l a Li/3). 

A3„. N,(a =► 0) => (iV,a iVi/3). 

A4„. a - => Ljcr A iVjcr if cr is an i-subjective formula. 

A5 n . iVjQ => ->Lia if ->a is a K45„-consistent z-objective basic formula. 

Inference Rules: 

MP„. From a and a ^ (3 infer /3. 
Nec„. From a infer and Nice. 

Notice that A5 n assumes that a ranges only over basic z-objective formulas. We need 
this restriction in order to appeal to satisfiability in the existing logic K45„|] To get 
a more general version of A5 n , that applies to arbitrary formulas, we will need to 
appeal to consistency within the logic that the axioms are meant to characterize. We 
return to this issue in Section ||. It is not hard to show that these axioms are sound. 

Theorem 3.10 [§J) For all a in OAf£ n , if ha then |= c a. 



Proof The proof proceeds by the usual induction on the length of a derivation. Here 
we show only the soundness of A5„. Suppose a is a basic z-objective formula such 



that —<a. is K45 n -consistent. Thus, there is an i-set containing —*a. By Theorem 3.5, it 
follows that for each world w € W c , there is a world w' «j w such that (M c , w') |= ->a. 
If w 1 e lCt(w), it follows that (Af c , w) \= ^L t a. If w' $ K.f(w), then (M c ,w) |= ^N,a. 
Thus, (M c ,w) \= -lijaV-iJVja; equivalently, (M c , w) \= N,a => -^L,a. It follows that 
|= Nia => -iLi<x. 

We show in Section ^that this axiomatization is incomplete. In fact, the formula 
—>Oi-*Ojp is not provable. Intuitively, part of the problem here is that A5„ is restricted 
to basic formulas. For completeness, we would need an analogue of A5„ for arbitrary 
formulas. However, we obtain completeness for a restricted language, which we call 
OJ\f£~. Roughly, the restriction amounts to limiting what an agent can only know. 
In particular, only knowing can only be applied to basic formulas. 

Definition 3.11 OAf£~ consists of all formulas a in OAf£ n such that, in a, no Nj 
may occur within the scope of an Ni or i,; for i =/= j. 

For example, NiLi^Nip and Ni(LjpV Ni~<p) are in OM£~, and NiNjp and NiLjNip 
are not, for distinct i and j. Note that formulas such as Oi~>Ojp cannot be expressed 
mON£-. 

To prove completeness for the sublanguage ON£~, we need four preliminary 
lemmas. The first describes a normal form for formulas. Having such a normal form 
greatly simplifies the completeness proof. 

9 Note that this peculiar axiom schema is recursive since satisfiability in propositional K45n is 
decidable |g|. 
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Lemma 3.12 Every formula a in ONC n is provably equivalent to a disjunction of 
formulas of the following form: 

a A £i<ySio A ->L\(fx\ A ... A ^Lnpx mi A ... A L n <p n o A ^L„ip nl A ... A ^L n <p nm , n A 
Nfipio A ->Niip n A ... A ^Nitp lkl A ... A A^VnO A -<N n ip n i A ... A ^N n ip nkn , 

where u is a propositional formula and and ipij are all i-objective formulas. More- 
over, if a in ONC~, we can assume that ipij and are i-objective basic formulas. 

Proof We proceed by induction on the structure of ip. The only nontrivial cases are 
if ip is of the form Liip' or Np' . If ip is of the form Li<p' , then, since ip £ OAf£~, Nj 
does not appear in p' for j i. We use the inductive hypothesis to get tp' into the 
normal form described in the lemma. Notice that Nj does not appear in the normal 
form for j i. We now use the the following equivalences to get Liip' into the normal 
form: 

• Li(ip A ip') O (Liip /\ Liip') 

• Li(ip V Liip') & (Liip V Liip') 

• Li(ip V -'Liip') (L,Vj V -iLiip') 

• LiLiip O Lj^ 

• {—iLifalse A L^Liip) -O- ->Liip 

• L^Niip <^> -liVj^). 

The first five of these equivalences are standard K45„ properties; the last two are 
instances of axiom A4 n . Similar arguments work in the case that tp is of the form 
Ni<p'. We leave the straightforward details to the reader. 

The next two lemmas give us some basic facts about the satisfiability and validity 
of formulas in ON~C~ . 

Lemma 3.13 If Sj is a set of consistent j-sets, j = l,...,n, and a is a consistent 
propositional formula, then there is a K45„ situation (M, w) such that (M, w) \= a 
and Objj(M,w) = Sj. 

Proof This follows immediately from part (b) of Proposition |4.2| below. 

Lemma 3.14 If ip and ip are i-objective basic formulas such that Liip A Niip is con- 
sistent, then <p V ip is valid. 

Proof Suppose that ->y> A -iif> is consistent. Then, by Axiom A5„, Ni(ip V ip) 
-iLi(ip V ip) is provable. It follows that Niip =>■ ->I^y> is provable, contradicting the 
consistency of Li<p A Nip. 
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The last lemma gives us a sharper condition on when w' £ K.%{w). This condition 
will prove useful in the completeness proof. 

Lemma 3.15 If w,w' are worlds in the canonical model such that w ~i w' and 
w' )Q?(w), then there is an i-objective basic formula tp such that Li<p £ w and 
tp ^ w'. 



Proof By the construction of the canonical model, we know that if w' £ fC f jw), 
then there is some basic formula tp such that L^tp £ w and tp w' . From Lemma p. 12 , 
it follows that we can assume without loss of generality that tp is in the normal 
form described by that lemma. Let A consist of all subformulas of tp that are of 
the form Liip and do not appear in the scope of any other modal operator. Let 
tpA be A^eAn™ ^ A /\^ eA _ w -^jj- It is easy to see that tpA £ w (since each of its 
conjuncts is). Since w ~i w' , it follows that tpA £ w' . Let tp' be the result of replacing 
each subformula Liip of tp that is in A by either true or false, depending on whether 
Litp £ w. By construction, tp' is z-objective. It is easy to see that tpA {tp <^ tp') 
is provable. It follows that tp' ^ w' . It also follows that LitpA =>■ (Li<^ Lj^>') 
is provable. Since tp A is an i-subjective formula, tp A =>■ is provable. Hence, 

LitpA £ MJ- Since £ iu, it follows that L^' £ u>. This gives us the desired result. 

We are finally ready to prove the completeness result. 

Theorem 3.16 @ For all a £ OAfC~, if \= c a then ha. 



Proof As usual, it suffices to show that if the formula a £ ON C n is consistent, then 
it is satisfiable in the canonical model. Without loss of generality, we can assume 



that a is in the normal form described in Lemma 3.12 



a A L x tp w A -iLupxi A ... A ^L x tpx mi A ... A L n tp nQ A ^L n tp nl A ... A ^L n tp m 
Nxtpxo A -■iViV'ii A ... A -nA^iVife A ... A N n ^ n0 A -^N n ip nl A ... A ^N n i() nkn . 

Moreover, since a £ ONC~, we can assume that tpij and are i-objective basic 
formulas. Let Ai consist of all the consistent formulas of the form tp i0 A tpio A ~>tpij or 
tpm A tpio A ->ipij, j > 1. Let £j be a formula that is independent of all the formulas 



in Ai; such a formula exists by Lemma 3.9. Let Si consist of all ?-sets containing 
(fio A (->V»Q v ("^io A &)). By Lemma |3.13 , there is a K45„ structure {M,w) such 



that Obj i {M,w) — Si, i — 1, . . . , n, and {M, w) \= a. Thus, there must be a world 
w* in the canonical model such that w* = {basic tp' | {M, w) (= tp'}. We claim that 
{M c ,w*) \= a. 

To see this, let a' be the formula uAiiyio A-<Li<pu A. . . A->Li</5i mi A. . .AL n tp n0 A 
-iL n cp n i A ... A -iL n tp nrrln . We first show that (M, u>) |= a'. By construction, we have 
that (M, uj) |= a. Furthermore, by definition, each world w' £ ICf 1 {w) satisfies 99^05 
so we have that {M,w) \= Litp i0 . Since Litpig A -^Litpij is consistent for each j > 1, 
it must be the case that tpiQ A ~>tpij is consistent. Thus, one of tp i0 A -iipio A ~>tpij 
or t/3 i0 A V'io A is consistent. If the latter is consistent, then by the choice of £, 
tpm Aipio A£i A-npij must be consistent as well. Since Si consists of all «-sets containing 
tpio A {->tpio V {ipio A & )), it follows that there must be an i-set in Si containing -itpij. 
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It follows that (M,w) |= -*Li(pij, for j > 1. Thus, we have shown that (M, w) \= a'. 
Since (M,w) and (M c ,w*) agree on basic formulas, it follows that (M c ,w*) \= a'. 

Next, we show that (M c ,w*) |= iVi^>io A ... A N n ip n o. To this end, suppose 
that w' ~i w* and w' £ fC^(w*). By Lemma 3.15, there must be some i-objective 
basic formula ip' such that Liip' G w* and -iip' G «/. Since Litp' e u>*, it follows that 
(M, u>) |= Lj^J 7 , and hence tp' is in every i-set in S{. It follows that obj^w') £ &j. Now, 
one of the following four formulas must be in obj i (w'): (1) tpio A ipio, (2) <Pjo A _i V'iO; 
(3) -"^io A V'tO; (4) ""^io A ~~ '^io ■ Since A Niip i0 is consistent, it cannot be (4), 

by Lemma |3.14 . It cannot be (2), for otherwise w' would be in Si. Thus, it must 
be (1) or (3), so tfj i0 E obj i (w'). Since this is true for all w' such that w' ~i w* and 
w' £ ICfiw*), it follows that (Af c , to*) \= N^ t0 , for i = 1, . . . , n. 

Finally, we must show that (M* , w*) \= -iN%ipij, for i = 1, . . . ,n and j = 1, . . . , k%. 
Clearly tpio A ~<ipij is consistent, for otherwise Niipio A -iNiipij would be inconsistent. 
Thus, at least one of (1) tpio A ^Vij A -«£io or (2) A A (pio is consistent. In 
case (2), by choice of the formula V^o A -i^j A A is consistent. Let f3 
be ipio A -i-iAij A -K^io if it is consistent, and V^p A -f0ij A A otherwise. By 
construction, /3 is consistent. By Lemma |3-4 there is a situation (M',v) such that 
subj^M' ,v) = subji(M* ,w*) and (M',v) (= /?. There is a world to" in the canonical 
model which agrees with (M',v) on the basic formulas. By construction, we have 
to" «j u>*. Moreover, since (M c ,w) |= Li(ip i0 A (-i^io V (V>io A £))), it follows that 
(M c ,u>*) |= Lj-./3. Since (M c ,ii/) \= (3, we have that to' £ /C?(to*). Moreover, since 
(M c ,w') \= -i^ij, it follows that (M c ,w*) |= -iN^ij, as desired. This completes the 
proof. 



3.2 Discussion 

As we have shown, the canonical-model semantics for AT, has some attractive features, 
in particular when restricted to the language ONC~ . It is for this sublanguage that 
we have a nice proof-theoretic characterization. There is some evidence, however, that 
the semantics may not have the behavior we desire when we move beyond OJ\fC~ . For 
one thing, the formula ->Oi~'Ojp is valid in the canonical model: it is impossible that 
all i knows is that it is not the case that all j knows is p. While it is certainly consistent 
for -^Oi^Ojp to hold, it seems reasonable to have a semantics that allows Oi^Ojp to be 
hold as well. As we have seen, the validity of -^Oi^Ojp follows from the fact that the 
canonical-model semantics does not have the third property of Levesque's semantics 
in the single-agent case: not all subsets of conceivable states are possible. In the 
next section, we discuss a different approach to giving semantics to only knowing — 
essentially that taken in H — that has all three of Levesque's properties, at least 
as long as we continue to represent an agent's objective state of affairs using basic 
formulas only. The approach agrees with the canonical-model approach on formulas 
in OAf£~, but makes O^Ojp satisfiable. Unfortunately as we shall see, it too suffers 
from problems. 



4 The i-Set Approach 

In the i-set approach, we maintain the intuition that the set of conceivable states for 
each agent i can be identified with the set of i-sets. We no longer restrict attention 
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to the canonical model though; we consider all Kripke structures. 

We define a new semantics |=' as follows: all the clauses of |=' are identical to the 
corresponding clauses for |=, except that for iVj. In this case, we have 

(M,w) \=' N,ip iff (M',w') \=' ip for all situations (M',w') such that 
Obji(M,w) = Obj t (M',w') and obj t (M',w') £ Obj-(M,w). 

Notice that |= and |=' agree for basic formulas; in general, as we shall see, they differ. 
We remark that this definition is equivalent to the one given in [||, except that there, 
rather than i-sets, i-objective trees were considered. We did not want to go through 
the overhead of introducing i-objective trees here, since it follows from results in 
H |(| that i-sets are equivalent to i-objective trees: every i-set uniquely determines 
an i-objective tree and vice versa. 

How well does this approach fare in terms of computing the truth of a formula at a 
given world. Since we now allow arbitrary structures, not just the canonical model, it 
seems that for computational reasons, it seems we ought to focus on finite structures. 
However, when it comes to formulas of the form A^a, where a is i-objective, satisfiable 
formula, it can be shown that (M, w) \=' -iA^a. There are simply too few sets in 
Obj^Mjiv) if M is finite to have -ia hold in all "impossible" situations. This means 
that to really model interesting situations with only knowing, we must use infinite 
models, and we are back to the problems discussed in the case of the canonical model. 
Thus, again we focus on whether this approach gives reasonable semantics to the iVj 
operator. 

Notice that to decide if Nitp holds in (M, w), we consider all situations that agree 
with (M, w ) on the set of possible states, hence this semantics satisfies the first of 
the three properties we isolated in the single-agent case. It is also clear that the 
i-sets considered in evaluating the truth of N^(f are precisely those not considered in 
evaluating the truth of Lup; hence we satisfy the second property. Finally, as we now 
show, for every set S of i-sets, there is a situation (M,w) such that Obj^M.w) = S. 
In fact, we prove an even stronger result. 

Definition 4.1 Let obqt (M, w) consist of all i-objective formulas (not necessarily 
just i-objective basic formulas) true at (M, w) (with respect to (=') and let Obif(M, w) 
= {objt(M,w') | w' e K,f{w)}. 

Proposition 4.2 Let T be a satisfiable set of i-objective formulas, let Si be a set of 
maximal satisfiable sets of i-objective formulas, i = 1, . . . , n, let E be a satisfiable set 
of i-subjective formulas, and let a be a satisfiable propositional formula. Then 

(a) there exists a situation (Mi , w\ ) such that T C objf (Mi , w\ ) and Si — Objf (Mi ,wi). 

(b) there exists a situation (M2,u>2) such that (M2,W2) |= a and Obf^ (M 2 ,W2) = 
Sj, j = 1, ...,n. 

(c) there exists a situation (M^^ws) such that (M3,ws) \= T A S. 

Proof For part (a), we first show that, given an arbitrary situation (M, u>), we can 
construct a situation (Al*,w*) such that objf(M*,w*) = objf(M,w) and there are 
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no worlds i-accessible from w*. The idea is to have M* be the result of adding w* 
to the worlds in M, where w* is just like w except that it has no j-accessible worlds 
and w* is not accessible from any world. More formally, if M = (W, n, JCi, . . . , JC n ), 
we take M* = {W*, tt*, K*, . . . , JC*), where W* = W U {w*}, tt*(w') = tt(w') for 
w' G W, tt*(w*) = n(w), )q = K,j U \(w*,w') \ w' G Kj(w)} for j ^ i, and JC* = /Q. 
It is easy to see that JC* is Euclidean and transitive. By construction, there are no 
worlds i-accessible from w* and (w',w*) £ JC* for all w' and all j. Moreover, if ip is 
an i-objective formula, we have (M*,w*) |=' ijj iff (M,w) \=' ijj, since for j ^ i, we 
have JCj(w*) — JCj(w). In particular, this means that objf (M* ,w*) — objf(M,w). 

For each A G S' = Si U {r}, there is a situation (Af A ,w A ) |=' A, where 
M A = (W A , 7r A , JCi, . . . , /C A ). By the argument above, we can assume without 
loss of generality that there are no worlds i-accessible from w A and w A is not ac- 
cessible from any world. We define Mi = (W, n, JC%, . . . , JC n ) by taking W to be the 
union of all the worlds in W A , A G S' . (We can assume without loss of general- 
ity that these are disjoint sets of worlds.) We define n so that n\yyA = n A . We 
define JCj = UAeS'JC A for j ^ i, and /Q to be the least transitive, Euclidean set 
containing U AG S'/C A U {(w r ,w A ) A G S}. It is easy to check that obj+(Mi,w A ) = 
obj^(M A ,w A ) (although this depends on the fact that wa is not j-accessible from 
any world for j ^ i). Thus, Objf (Mi,w r ) = Si and objf(Mi, w r ) D T. Thus, we can 
take wi = w r , completing the proof of part (a) . 

To summarize the construction of part (a), we start with an arbitrary situation 
(M, w) satisfying T, convert it to a situation satisfying Lifalse A T, essentially by 
modifying the i- accessibility relation at w so that there are no worlds i-accessible from 
w and w is not accessible from any world, and then again modifying the ^-accessibility 
relation at w so that we get a structure (Mi, wi) such that Objf(Mi, Wi) = Si. Note 
that in doing this construction, we did not change the propositional formulas true 
at w, nor did we change the worlds that were j-accessible from w for j ^ i. Thus, 
starting with a situation that satisfies a propositional formula a, we can repeat this 
construction for each i in turn, for i = 1, . . . , n. The resulting situation is (Ma, W2), 
and it clearly has the desired properties. This proves part (b). 

For part (c), suppose (M',w') |= E; let Ob]j{M',w') = S t . By part (a), there 
is a situation (M 3 ,w 3 ) such that 0&j+(M 3 ,u>3) = Si and (M 3 ,u> 3 ) \= T. Since the 
set of subjective formulas true at a situation (M, w) is completely determined by 
Objf(M,w), and Objf(M',w') = Objf(M 3 ,w 3 ), it follows that (M 3 ,u> 3 ) |= E as 
well. 

How does this semantics compare to the canonical model semantics? First of all, 
it is easy to see that the axioms are sound. We write \=' if (A/, w) \=' tp for every 
situation (M, w). Then we have the following result. 

Theorem 4.3 j| For all a £ OJ\fC n , if h a then |=' a. 

Proof As usual, the proof is by induction on the length of a derivation. All that 
needs to be done is to show that all the axioms are sound. Again, this is straightfor- 
ward. The proof in the case of A5 n proceeds just as that in the proof of Theorem |3.10 , 
using the fact that this semantics satisfies Lcvesque's second property. 

Moreover, we again get completeness for the sublanguage ONC~. 
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Theorem 4.4 g For all a e ON£~, h a iff |=' a. 



Proof As usual, it suffices to show that if a is consistent with the axioms, then a is 
satisfiable under the \=' semantics. From Theorem [3.16| , we know that a is satisfiable 
in the canonical model under the |= semantics. Thus, it suffices to show that for 
all formulas a e CW£~, we have (M c ,w) \= a iff (M c ,w) \=' a. By Lemma |3T2 



it suffices to consider formulas a in normal form. We proceed by induction on the 
structure of formulas. The only nontrivial case obtains if a is of the form Nia'. Since 
a is in normal form, we can assume that a' is basic. Suppose (M c ,w) \=' Nia'. 
To show that (M c ,w) \= Nia', we must show that if w' w and w' ^ K^(w), 
then (M c ,w') \= a. By definition, if w' Wj w, then Obj i (M c ,w f ) = Obj^M^w). 
Moreover, we must have obj i (M c ,w') £ Obj i (M c ,w), for otherwise we would have 
w' G JC1(w). Hence, we must have (M c ,w') \=' a'. By the induction hypothesis, we 
have {M c ,w') |= a'. Thus, (M c ,w) \= N t a' , as desired. 

For the converse, suppose that (M c , w) \= Nia'. We want to show that (M c , w) \=' 
Nia'. Suppose that (M',w r ) is such that Obj 4 (M' ,w') = Ob^M ,™) and obj i (M',w') < 
Obji(M c ,w). We must show that (M',w') \=' a. It is easy to see that for every sit- 
uation (M, w) and basic formula ip, we have that (M, w) \= Li<p iff (M, w) \=' Liip iff 
<p is in every set in Obji(M,w). Thus, it follows that subj^M' , «/) = subji(M c ,w). 
There must be a world w" in M c such that (M c ,w") agrees with (M',w') on all 
basic formulas according to the (= semantics. Since subj^M ,w") = subji(M c ,w), 
it follows from Lemma |3.3| that w w" . Since obj^M' ,w') ^ Obji(M c ,w) and 
obj^M'.w') = obj t (M c ,w"), it follows that to" £ £?(«;). Since (M c ,w) |= Nia', we 
must have that (M c ,w") |= a'. And since (M c ,w") and (M',w') agree on basic for- 
mulas, it follows that (M',w') \= a'. Finally, since ^ and \=' agree for basic formulas, 
we have (M 1 , w') (=' a'. This completes the proof that (M, w) \= Nia'. 

Although our axiomatization is complete for OMC~, as we now show, it is not 
complete for the full language, for neither |= nor \=' . Since the axiomatization is sound 
for both j= and )=', to prove incompleteness, it suffices to provide a formula which 
is satisfiable with respect to \=' and not |=, and another formula which is satisfiable 



with respect to |= and not |='. As is shown in Proposition 4.5, O^Ojp is satisfiable 
with respect to |=' and (by Proposition |3.8| ) not with respect to |=. On the other 
hand, it is easy to see that Lj false A Nj^Oi^Ojp is satisfiable with respect to |= (in 
fact, it is equivalent to Ljfalse); as shown in Proposition 4.6, it is not satisfiable with 
respect to |='. 

Proposition 4.5 Oi^Ojp is satisfiable under the \=' semantics. 



Proof Let S = {objf(M,w) | (M, w) \=' ^Ojp}. By Proposition ^J, there is a sit- 
uation (M*,w*) such that Objf(M*,w*) = S. We claim that (M* ,w*) \=' O l ^O j p. 
Clearly (M*,w*) \=' Li^Ojp, since ~^Ojp is true at all worlds i-accessible from 
w*. To see that (M*,w*) \=' N,O p, suppose that Obj % (M,w) = Obji(M*,w*) 
and obji(M,w) £ Obj t (M*,w*). We want to show that (M,w) |=' Ojp. Sup- 
pose that [M, w) \=' ^Ojp. By definition, objf(M,w) £ S, so there is some world 
w' £ Kf 1 (w*) such that objf(M*,w') — ob]f(M,w). In particular, this means that 
obji(M* ,w') — obji(M,w). But this contradicts the assumption that obji(M,w) £ 
Obji(M*,w*). Thus, (M,w) \= Ojp as desired, and (M*,w*) \= 0^0 jp. 
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Proposition 4.6 There is a formula (3 such that |=' (3 but -i/3 is satisfiable under the 
^= semantics. 



Proof We first show that if <p is an i-objective formula that is satisfiable under the \=' 
semantics, then |=' Lifalse => — iAT^— i^?. For suppose that <p is satisfiable in a situation 
(M,w). By Proposition fy| there is a situation (Af*,w*) such that objf(M*,w*) = 
objf(M,w) and Objf(M*,w*) = 0. This means that (M*,w*) |=' ipMJalse. Now let 
(M',w') be any situation satisfying Li/aZse. Then Obj 2 (M',w') = Obj^M* ,w*) = 0, 
and obj^M^w*) £ Obj i (M',w'). It follows that (M',w') [=' -.iV,-^. Thus, we 



have shown that |=' Lifalse -iNi—«p. Since, as we showed in Proposition 4.5 
the formula Oj^Oip is satisfiable, this means that \=' Lifalse => ^Ni^Oj^Oip. On 
the other hand, since Oj—>Oip is not satisfiable with respect to |=, as we showed in 
Proposition 3JJ, neither is ^N^Oj^OiP, and hence Lifalse => ^N^Oj^OiP is not 



valid under the |= semantics. Indeed, Lifalse A N^Oj^OiP is equivalent to LJalse 
under the |= semantics. 

We can now show that our axiom system is incomplete for the full language with 
respect to both the |= and |=' semantics. 

Theorem 4.7 There exist formulas a and (3 in OAf£ n such that \f a and |= a, and 

\f (3 and \=' p. 



Proof By Propositions 3.8 and [4.5| , we have that |= -iOj->Oip, but y=l -^Oj^Oip. 

Since h is sound with respect to p, we cannot have I iOj—>Oip (for otherwise we 

would have |=' -iOj—iOip). Thus, we can take a to be ->Oj->Oip. A similar argument 
shows we can take (3 to be Lifalse =>■ ^Ni^OjOip. 

The fact that neither |= nor |=' is complete with respect to the axiomatization 
described earlier is not necessarily bad. We may be able to find a natural complete 
axiomatization. However, as we suggested above, the fact that ->Oj-iOip is valid under 
the |= semantics suggests that this semantics does not quite satisfy our intuitions with 
regards to only-knowing for formulas in ONC n — OAf£~. As we now show, \=' also 
has its problems. We might hope that if (p is a satisfiable i-objective formula, then 
Nitp ~^Lip> would be valid under the \=' semantics. Unfortunately, it is not. 

Proposition 4.8 The formula N^Ojp A L^Ojp is satisfiable under the \=' seman- 
tics. 



Proof First we show that for any situation (M, w) that satisfies Ojp, there exists 
another situation (Af, w') such that (M, w) and (M 1 , w') agree on all basic formulas, 
but (M',w') \=' ~^Ojp. We can construct (M',w') as follows: Choose a particular 
set r S Objj(M,w). It easily follows from Proposition [T^ that there is a situation 
(M'X) such that Objj(M',w') = Obj^M^w) - {r} and obj^M' ,w') = obj 3 (M,w). 
We now show that for any basic formula <p, we have (M, w) \=' ip iff (M 1 , w') \=' p. If 
ip is a j-objective formula, this is immediate from the construction. Thus, it suffices 



to deal with the case that <p is of the form Ljip' . By Lemma 3.12, we can assume 
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without loss of generality that tp' is j-objective. Suppose that ip' is a consistent j- 
objective formula. In this case, it is almost immediate from the definitions that if 
(M,w) \=' Lj(p' then (M',w') \=' Ljtp'. For the converse, suppose that (M, w) \=' 
^Ljtp' . Then there is some world w" G ICj^w) such that (M, w") \= ->ip'. Since 
(M,w) \=' Ljp, we have that (M,w") \=' p A -iy>'. Let ^ be a j-objective basic 
formula that is independent of p A -k^'. Let ip" be 99' A p A -1^ if ^ G T, and tp' /\p Aip 
otherwise. Since ip is independent of p A -up', it follows that ip" is consistent. Let A 
be any j-set containing ip" . It must be the case that A £ Objj(M,w), for if not, let 
(M*,w*) be a situation such that Obj^M* ,w*) = Objj(M, w) and obj j {M*,w*) = A 
(such a situation exists by Proposition [4.2| ). Then (M*,w*) |= p, contradicting the 
assumption that (M, w) \= Nj^p. By construction, A ^ T. Thus, there is some 
world v G JCf'{w') such that objj(M' » = A. It follows that (M',u) |=' "V, 
so (M',w') -^Ljip'. Thus, (M',w') agrees with (M, w) on all basic formulas. 
However, since F ^ Objj(M,w), it follows that (M',w') \= ^Nj^p, and hence that 

!/'•»"): a,, 



Let S" = {ob]~l (M^w) | (M, w) ^' -^Ojp}. By Proposition |42j, there is a situation 
(M*,w*) such that Obj+(M*,w*) = S. Clearly (M*,w*) |=' L^O p. We now show 
that (M*,w*) ^' N^Ojp as well. For suppose that (M,w) is a situation such that 
Obji(M,w) = Obj^M*,™*) and obj^M^w) Ob^ (M*, w*). Moreover, suppose, by 
way of contradiction, that (M, w) |=' Ojp. By the arguments above, it follows that 
there is a situation (M',w') such that (M',w') |=' ^Oj-p and (M , w) and (M',u/) 
agree on all basic formulas. By construction, objf (M' ,w') e S — Objf(M*,w*), 
so obj^M^w') G Obj^M* ,W*). Since obj^M.w) = obj^M' ,w'), we must also have 
o6jj(M, w) G Obj t (M* ,w*), contradicting the choice of (M, u>)- Thus, (M, w) \= 
->Ojp, as desired, and so (M*,w*) |= L^Ojp A N^Ojp. 

4.1 Discussion 



Proposition 4.8 shows that although the i-set semantics has the three properties we 
claimed were appropriate, JVj and still do not always interact in what seems to be 
the appropriate way. Intuitively, the problem here is that there is more to i's view of 
a world than just the i-objective basic formulas that are true there. We should really 
identify i's view of a situation (M, w) with the set of all i-objective formulas that are 
true there. In the canonical-model approach, the i-objective basic formulas that are 
true at a world can be shown to determine all the i-objective formulas that are true 
at that world. This is not true at all situations under the i-set approach. 

Indeed, it is no longer true that the i-set approach has the second of the three 
properties once we take i's view of (M, w) to be obj^(M, w). For consider the situation 



(M*,w*) constructed in the proof of Proposition 4.8. As the proof of that lemma 
shows, {obj+(M*,w) I w G fCf* (w*)} U {obj+(M', w') | obj^M' ,w') £ Obj z {M*,w*)} 
does not include all maximal sets of i-objective formulas. In particular, it does not 
include those maximal sets that satisfy Ojp. 

To summarize: while the i-set approach arguably has enough worlds, it suffers 
from the fact that the full complement of worlds is not always taken into account for 
Li and Ni, as the above example shows. While the canonical model approach does 
not run into this problem, it suffers from a perhaps more basic deficiency: there just 
are not enough worlds to begin with. For example, there is no world where OiOjp is 
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true. 

We consider a different approach in the next section that attempts to deaf with 
both problems. 

5 What Properties Should Only Knowing Have? 

Up to now, we have provided two semantics for only knowing. While both have 
properties we view as desirable, they also have properties that seem somewhat un- 
desirable. This leads to an obvious question: What properties should only knowing 
have? Roughly speaking, we would like to have the multi-agent version of Levesque's 
axioms, and no more. Of course, the problem here is axiom A5„. It is not so clear 
what the multi-agent version of that should be. The problem is one of circularity: 
We would like to be able to say that Ni<p =>■ -*Li(p should hold for any consistent 
i-objective formula. The problem is that in order to say what the consistent formulas 
are, we need to define the axiom system. In particular, we have to make precise what 
this axiom should be. 

To deal with this problem, we extend the language so that we can explicitly talk 
about satisfiability and validity in the language. We add a modal operator Vol to 
the language. The formula Val(ip) should be read "<p is valid". Of course, its dual 
Sat(ip), defined as -^Val(^ip), should be read "<p is satisfiable" . With this operator in 
the language, we can replace A5„ with 

A5J,. Sat(-ia) =>■ (A^a =4> ->Lia) if a is i-objective. 

In addition, we have the following rules for reasoning about validity and satisfia- 
bility: 

VI. ( Val(ip) A Val(cp => ip)) Val(^). 

V2. Sat(ip), if tp is a satisfiable propositional formula.^ 

V3. (Sat(a A 0i ) A ... A Sat(a A f3 k ) A Satfa A Si) A... A Satfa A 5 m ) A Val(a V 7 j) => 
Sat(L t a A -.L,:-./3i A ... A ^L^f3 k A Ntf A -A^i A ... A -^N l ^8 m ), 
if a, /3i, . . . , (3k, 7, Si, . . . , S m are i-objective formulas. 

V4. (Sat(a) A Sat((3J) Sat(a A (3) if a is i-objective and (3 is i-subjective. 

Necy. From (p infer Val(tp). 

Axiom VI and the rule Necy make Vol what is called a normal modal operator. 
In fact, it can be shown to satisfy all the axioms of S5. The interesting clauses are 
clearly V2-V4, which capture the intuitive properties of validity and satisfiability. 

If we restrict to basic formulas, then V3 simplifies to (Sat(a A (3i)A. . .ASat(a A /3k)) =r- 
Sat(LiOL A A ... A ~^Li^(3k ) (we can take 7, 5i, . . . , S m to be true to get this). 

The soundness of this axiom (interpreting Sat as satisfiability) follows using much the 
same arguments as those in the proof of Proposition |4.2| . The soundness of V4 if we 
restrict to basic formulas follows from Lemma |3.4| . More interestingly, it follows from 

10 We can replace this by the simpler Satfp^ A ... A p' k ), where p' t is a literal — either a primitive 
proposition or its negation — and A ... A p', is consistent. 



22 



the completeness proof given below that these axioms completely characterize satisfi- 
ability in K45„; together with the K45„ axioms, they provide a sound and complete 
language for the language augmented with the Val operator. 

Let AX' consist of the axioms for ONC given earlier together with V1-V4 and 
Necy, except that A5„ is replaced by A5^. AX' is the axiom system that provides 
what we claim is the desired generalization of Levesque's axioms to the multi-agent 
case. In particular, A5^ is the appropriate generalization of A5. The question is, 
of course, whether there is a semantics for which this is a complete axiomatization. 
We now provide one, in the spirit of the canonical-model construction of Section |3[ 
except that, in the spirit of the extended situations of Section we do not attempt 
to make the set of worlds used for evaluating Li and iVj disjoint. 

Let ONC+ be the extension of ONC n to include the modal operator Val. For 
the remainder of this section, when we say "consistent" , we mean consistent with 
the axiom system AX'. We define the extended canonical model , denoted M e = 
{W e ,TT e ,JC\, . . .,Kl,Mi, ■ ■ ■ .JVn)i as follows: 

• W e consists of the maximal consistent sets of formulas in ONC^ . 

• For all primitive propositions p and w G W e , we have ir e (w)(p) = true iff p G w. 

• (w,w') G Kf iSw/Li C w'. 

• (w,w') eJV[ iSw/Ni C w'. 

In this canonical model, the semantics for Li and Ni is defined in terms of the K,\ 
and relations, respectively: 

(M e ,w) |= Lid if (A/ e , w') \= a for all w' such that (w, w') G JCf. 
(M e , w) \= N % a if (M e , w') \= a for all w' such that (w, w') G A^ e . 

We define the Val operator so that it corresponds to validity in the extended canonical 
model: 

(M e ,w) \= Val(a) if (M e ,w') |= a for all worlds w' in M e . 

We now want to show that every formula in a maximal consistent set is satisfied 
at a world in the extended canonical model. To do this, we need one preliminary 
result, showing that Val and Sat really correspond to provability and consistency in 
this framework. 

Proposition 5.1 For every formula ip G OAf£ n , if ip is provable then so is Val((f), 
while if ip is not provable, then -iVal(ip) is provable. 



Proof By Necy, it is clear that if tp is provable, so is Val(ip). Thus, it remains 
to show that if cp is not provable, then -iVal(<p) is. Using VI, it is easy to see that 
-< Val ((f) is provably equivalent to Sat(-«p), so it suffices to show that if tp is not 
provable — i.e., if -up is consistent — then Sat(-np) is provable. We prove by induction 
on ip that if ip is consistent, then Sat(p) is provable. 

If ip is propositional, the result is immediate from V2. For the general case, we 
first use Lemma 3.12 to restrict attention to formulas in the canonical form specified 
by the lemma. Using standard modal reasoning (VI and Necy) it is easy to show 
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that h Sat(<p\/ip) <^> (Sat(ip) V Sat(tp)). Thus, it suffices to restrict attention to a 
conjunction in the form specified by the lemma. It is easy to see that if the conjunction 
is consistent, then each conjunct must be consistent. Using V4, it is easy to see that 
we can restrict attention to i-subjective formulas. By applying Lemma 3.12, we can 
assume without loss of generality that we are dealing with a consistent formula ip 
of the form L t a A ~^L i ^(3 1 A ... A -ij^-i/?*. A Ntf A ^N^Si A ... A -^N t ^5 m , where 
a, /3i, . . . , /3fc,7, 5%, . . . , S m are all i-objective. We can also assume that each of a A 
i = 1, . . . , k and j A 5j, j — 1, . . . , m are consistent, for otherwise we could easily 
show that (p is not consistent. Finally, we can show that a V 7 must be provable, for 
if not, by applying A5' n , we can again show that ip is not consistent. We now apply 
the induction hypothesis to prove the result. 



Corollary 5.2 Each formula in ON is provably equivalent to a formula in ONC n . 

Proof We proceed by induction on the structure of formulas. The only nontrivial 
case is for formulas of the form Val(ip). By the induction hypothesis, <p is provably 
equivalent to a formula ip' S ONC n . By straightforward modal reasoning using VI 
and Necy, we can show that Val(ip) is provably equivalent to Val(ip'). By Proposi- 
tion 5.1, Val(ip') is provably equivalent to either true or false, depending on whether 



tp 1 is provable. 

Using standard modal logic techniques, we can now prove the following result. 

Theorem 5.3 M e is a K45„ structure (that is, /Cf and Nf are Euclidean and tran- 
sitive). Moreover, for each world w G W e , we have (M e , w) \= a iff a G w. 

Proof We leave it to the reader to check that the definition of ICf guarantees that 



M e is a K45 n structure. Given Corollary 5.2, which allows us to restrict attention 



to a £ OAT£ n , the proof that (M e ,w) ^ a iff a G w is completely straight forward 
and follows the same lines as the usual proofs dealing with canonical models (see, for 
example, @, ||). 

We say that a is e-valid , denoted \= e a, if M e |= a, that is, if (M e , w) \= a for all 
worlds w 6 W e . The following result is immediate from Theorem [5.3] . 

Corollary 5.4 \= e a iff AX' h a. 

Thus, AX' is a sound and complete axiomatization of ONC^ with respect to the \= e 
semantics. 

While AX' is sufficient for our purposes, it comes at the expense of having to 
explicitly axiomatize validity as part of the logic itself. While we view the ability to 
axiomatize validity and satisfiability within the logic as a feature in our approach, 
it is reasonable to ask whether it is really necessary. One of the anonymous referees 
suggested to us the following interesting variant, which may avoid this complication, 
although at the expense of an infinite number of axiom schemas. 

First we define an infinite sequence of languages ON L\ for k = 0, 1, 2 . . .: 

• CW£°= OAf£~ 
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• OMC^ +1 ~ {a | a is a Boolean combination of formulas of ON L\ together with 
formulas of the form Lid or Nia for a £ ONC^} 

Roughly, each language adds another level of nestings of only knowing with varying 
agent indices. For example, OAf£^ +1 contains the formula O^O^ . . .Oi k+1 p, where 
ij 7^ ij+i, something that cannot be expressed in ONC!^. 

Let AX* consist of the the axioms Al„-A4„ as before together with the following 
set of axioms 

where a is an i-objective ON formula which is 
consistent with respect to Al n -A4 n ,A5^, A5,^,. . . A5jj. 

It is not hard to show that the axioms are sound with respect to the semantics. 
Whether they are also complete remains an open problem. 

Apart from the question of axiomatization, how does the \= e semantics compare 
to our earlier two? Clearly, they differ. It is easy to see that the formula Oi^Ojp, 
which was not satisfiable under is satisfiable under \= e . In addition, the formula 
N^Ojp A Li^Ojp, which is satisfiable under |=', is not satisfiable under ^= e . In both 
cases, it seems that the behavior of ^= e is more appropriate. On the other hand, all 
three semantics agree in the case where our intuitions are strongest, ONC~. Since 
the axiom system AX characterizes how our earlier two semantics deal with ONC~ , 
this is shown by the following result. 

Theorem 5.5 If ip e ON£~, then AX h <p iff AX' h ip. 



Proof It is easy to see that each axiom of AX is sound in AX'. It follows that 
AX h ip implies AX' h tp. For the converse, it suffices to show that if ip £ ON£~ 
is consistent with AX, then it is also consistent with AX', i.e., that Sat(ip) holds. 
We show this by induction on the structure of ip, much in the same way we proved 



Proposition 5.1. We can assume without loss of generality that ip is a conjunction in 



the normal form described Lemma 3.12. It is easy to see that if we can deal with the 
case that ip is an i-subjective formula, then we can deal with arbitrary ip by repeated 
applications of V4 followed by an application of V2. Thus, suppose that ip is an 
i-subjective formula which is consistent with AX. We can assume that ip is of the 
form Lia A -^Li^\ A ... A -^Li^j3 k A Ntf A -iJVi— -5i A ... A ->Ni->5 m . We must have that 
a A (3j is consistent for j = 1, . . . , k, and that 7 A Si is AX-consistent for / = 1, . . . , to, 



for otherwise ip would not be AX-consistent. Similarly, by Lemma 3.14, we must have 
that a V 7 is K45„-provable, otherwise ip would not be AX-consistent. We can now 
apply V3 and the inductive hypothesis to show that a is AX'-consistent. 

Thus, we maintain all the benefits of the earlier semantics with this approach. 
Moreover, while it is just as intractable to compute whether (M e ,w) \= a for a par- 
ticular world w in the extended canonical model as it was in all our other approaches, 
we can show that the validity problem for this logic is no harder than that for K45„ 
alone. It is PSPACE-complete. 

Theorem 5.6 The problem of deciding if AX' h ip is PSPACE-complete. 
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Proof PSPACE hardness follows from the PSPACE hardness of K45„ We 
sketch the proof of the upper bound. First of all, observe that it suffices to deal with 
the case that tp is in OAfC n , since we can then apply the arguments of Corollary 
to remove all occurrences of Val from inside out. We consider the dual problem of 
consistency. Thus, we want to chec k if Sat(a) holds. The first step is to convert a 



to the normal form of Lemma 3.12 . Observe that a is consistent iff at least one of 
the disjuncts is consistent. Although the conversion to normal form may result in 
exponentially many disjuncts, each one is no longer than a. Thus, we deal with them 
one by one, without ever writing down the full disjunction. It suffices to show that we 
can decide if each disjunct is consistent in polynomial space, since we can then erase 
all the work and start over for the next disjunct (with a little space necessary for 



bookkeeping). We now proceed much as in the proof of Proposition 5.1. By applying 
V4 repeatedly and then V2 (as in the previous theorem), it suffices to deal with 
z-subjective formulas. We then apply V3 to get simpler formulas, and repeat the 
procedure. We remark that this gives another PSPACE decision procedure for K45„, 
quite different from that presented in |9|. 

To what extent do the three properties we have been focusing on hold under the 
|= e semantics? Suppose we take the conceivable states from i's point of view to be the 
maximal consistent sets of i-objective formulas with respect to AX', or equivalently, 
the set of z-objective formulas true at some world in M e . Let obif(M e , w) consist of all 
the i-objective formulas true at world w in the extended canonical model (under the 
\= e semantics) and let Obf i {M e ,w) = {objl(M e ,w') | w' £ /Cf(w)}. It is easy to see 
that the first two properties we isolated hold under this interpretation of conceivable 
state. However, it is quite possible that the "possible states" at a world (M c , w), that 
is, C%^(M c ,w), and the "impossible states", that is, {o&j^(M c ,w') | w' ~, W, w £ 
IC((w)} are not disjoint. 

Interestingly, this semantics does not satisfy the third property we isolated. Not 
all subsets of conceivable states arise as the set of possible states at some situation 



(M e ,w). A proof analogous to that of Lemma p.7| shows that Obj\ (M, w) is always 
limit closed. In the canonical model approach, limit closure prevents an agent from 
considering certain desirable sets of states. Now this is no longer the case, despite 
limit closure. Roughly speaking, we avoid problems by having in a precise sense 
"enough" possibilities. More precisely, given any consistent i-objective formula a, it 
is possible for agent i to only know a by virtue of considering all maximal sets of i- 
objective formulas which contain a. Thus, as we suggested earlier, the third property 
we isolated in the beginning turns out to be somewhat too strong — it is sufficient but 
not necessary once we allow for enough possibilities. 



6 Multi- Agent Nonmonotonic Reasoning 

In this section, we demonstrate that the logic developed in Section ^| captures multi- 
agent autoepistemic reasoning in a reasonable way. We do this in two ways. First we 
show by example that the logic can be used to derive some reasonable nonmonotonic 
inferences in a multi- agent context. We then show that the logic can be used to 

11 The result in H{ is proved only for KD45„, but the same proof applies to K45 n - 
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extend the definitions of stable sets and stable expansions originally developed for 
single agent autoepistemic logic to the multi-agent setting. 



6.1 Formal Derivations of Nonmonotonic Inferences 

In this section, we provide two examples of how the logic can be used for nonmonotonic 
reasoning. 

Example 6.1 Let p be agent i's secret and suppose i makes the following assumption: 
unless I know that j knows my secret assume that j does not know it. We can prove 
that if this assumption is all i believes then he indeed believes that j does not know 
his secret. Formally, we can show 

A formal derivation of this theorem can be obtained as follows. Let a = ->LiLjp ~^Ljp. 
The justifications in the following derivation indicate which axioms or previous deriva- 
tions have been used to derive the current line. PL or K45„ indicate that reasoning 
in either standard propositional logic or K45 n , which are subsumed by AX', is used 
without further analysis. 



1. 


Oi<x =>■ Lia 


PL 


2. 


OiU =>■ Ni~>a 


PL 


3. 


(LiOt A -^LiLjp) =*» L^L 3 p 


K45„ 


4. 


N^a => (Ni^LiLjp A N t L ]P ) 


K45 n 


5. 


Sat(p) 


V2 


G. 


Sat(p) => Sat(-iLjp) 


V3 


7. 


Sat(-iLjp) 


VI, PL 


8. 


Sat(-iLjp) => (NiLjp -iLiLjp) 


as; 


9. 


NzLjp =>• -^LiL 3 p 


PL 


10. 


Oia =>■ -^LiLjp 


2; 4; 9; PL 


11. 


Oia =>■ Li^Ljp 


1; 3; 10; PL 



To see that i's beliefs may evolve nonmonotonically given that i knows only a, assume 
that i finds out that j has found out about the secret. Then i's belief that j does 
not believe the secret will be retracted. In fact, i will believe that j does believe the 
secret. Formally, we can show 

h Oi(LjpAa) =^ L.Ljp. 

Notice that the logic itself is a regular monotonic logic; the nonmonotonicity of agent 
i's beliefs is hidden within the Oi-operator. 

All the formulas that appear in the proof above are in OAf£~. Thus, we could 



have used the somewhat simpler proof theory of Section 3.1. To obtain an example 
where we need the full power of AX', simply replace Ljp by Ojp, that is i now uses 
the default that unless he knows that j only knows p, then he assumes that j does not 
only know p. In other words, i (prudently) makes rather cautious assumptions about 
i's epistemic state and assumes that i usually knows more than just p. The proof is 
very similar to the one above. The only difference is that we now have to establish 
that Sat(-iOjp) is provable, which is straightforward. 

12 Note that if we replace Ljp by p we obtain regular single-agent autoepistemic reasoning. 
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Example 6.2 Now let p stand for "Tweety flies" .^| We want to show that if j knows 
that all i knows about Tweety is that by default it flies, then j knows that i believes 
that Tweety flies. As before, we capture the fact that all i believes is that, by default, 
Tweety flies, by saying that all i believes is that, unless i believes that Tweety does 
not fly, then Tweety flies. Thus, we want to show 

h LjOi(-<Li-tp => p) =>• L 3 Lip. 

We proceed as follows: 

1. Oj(-iLj-if> => p) =>• Lip as above, with Ljp replaced by ->p 

2. L j {o i (->L i ->p ^p)=> L iP ) 1; Nec„ 

3. I. ,(),< L, i> ^p)^> L 3 L lP 2; K45„ 

In a sense, i is able to reason about j's ability to reason nonmonotonically essentially 
by simulating j's reasoning pattern. 

A situation where i knows that all j knows is a seems hardly attainable in practice, 
since an agent usually has at best incomplete information about another agent's be- 
liefs. It would seem much more reasonable if we could say that i knows that a is 
all j knows about some relevant subject, say Tweety. This issue is dealt with in |l3f , 
where the canonical-model approach is extended to allow statements of the kind that 
all agent i knows about x is y. It is shown that the forms of nonmonotonic reasoning 
just described, when restricted to CW£~, go through just as well with the weaker 
notion of only knowing about. 



6.2 i-Stable Sets and i-Stable Expansions 

Single-agent autoepistemic logic was developed by Moore jl5| using the concepts of 
stable sets and stable expansions. Levesque proved that there is a close relationship 
between stable sets and only-knowing in the single-agent case. Here we prove an 
analogous relationship for the multi-agent case. We first need to define a multi-agent 
analogue of stable sets. 

In the single-agent case, it is well known that a stable set is a complete set of 
formulas that agent i could know in some situation; that is, a set S is stable if 
and only if there is a situation (W, w) such that S = {a (W,w) |= La}. This is 
the intuition that we want to extend to the multi-agent setting, where the underlying 
language is now OAf£ n . First we define logical consequence in the extended canonical 
model in the usual way: If T is a set of formulas, we write M e (= T if M e \= 7' for 
each formula 7' G T. We say that 7 is an e-consequence of T, and write T \= e 7, 
exactly if M e \= T implies M e \= 7. 

Definition 6.3 Let T be a set of formulas in ONC n . T is called i-stable iff 

(a) if T \= e 7 then 7 G T, 

(b) if a G r then L^a G T, 

(c) if a T then ^L t a G T. | 

13 Regular readers of papers on nonmonotonic logic will no doubt be gratified to see Tweety's 
reappearance. 
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Note that the only difference between i-stable sets and the original definition 
of stable sets is in condition (a), which requires i-stable sets to be closed under e- 
conscqucncc instead of tautological consequence (i.e., logical consequence in preposi- 
tional logic) as in the single-agent case. Using e-consequence rather than tautological 
consequence makes no difference in the single-agent case; in the multi-agent case it 
does. Intuitively, we want to allow the agents to use e-consequence here to capture 
the intuition that it is common knowledge that all agents are perfect reasoners under 
the extended canonical model semantics. For example, if agent i believes ^Ljp for a 
different agent j, then we want him to also believe Nj->Ljp. To do this, we need to 
close off under e-consequence. 

The next theorem shows that i-stable sets do indeed satisfy the intuitive require- 
ment. We define an i-epistemic state to be a set T of 07V£n-formulas such that for 
some situation (M e , w) in the extended canonical model, r = {«6 OJ\f£ n | (M e , w) \= 
LiCt}; in this case, we say that T is the i-epistemic situation corresponding to (M e , w). 
For a set of OTV£„-formulas r, let T = {7 | 7 e ON L n and 7 £ T}, L,T = {L, n | 7 6 
r}, and -.LiT = {^L. n | 7 6 T}. 

Theorem 6.4 Let T be a set of OA/"£„-formulas. T is i-stable iff T is an i-epistemic 
state. 

Proof It is straightforward to show that every i-epistemic state is i-stable. To show 
the converse, let T be i-stable. We need to show that it is also an i-epistemic state. 
Certainly LiT is consistent. If T contains all 0A/"£ n -formulas, that is, if agent i 
is inconsistent, then let (M e ,w) be a situation where K.f(w) = 0; such a situation 
clearly exists. Then T is the i-epistemic situation corresponding to (M e ,w). If T 
is a proper subset of the OA/"£„-formulas, then T must be consistent. (If T were 
inconsistent, by the first property of stable sets, T would contain all formulas.) In 
particular, this means that p A ~^p (f. T for a primitive proposition p. The second 
property of stable sets guarantees that LiT C T, while the third guarantees that 
~^Li{p A -ip) G T. Since T is consistent, so is LiT U {^Li(p A ~^p)}. W e consists 
of all the maximal consistent sets (with respect to AX'); thus, there must be some 
w* G W e that contains LiT U {^Li(p A ^p)}. We claim that T is the i-epistemic state 
corresponding to (M e ,w*). Thus, we must show that <p £ T iff (Al e ,w*) \= Liip. To 
see this, first suppose that ip G T. Thus, Liip £ LiT. By construction, w* contains 
LiT. By Theorem [T|, we have that (M e , w*) \= Liip. On the other hand, if tp £ T, 
then, since T is i-stable, we have that ->Liip e T. By the previous argument, it follows 
that (M e ,w*) \= Li~iLi(p. From A4 n , it follows that (M e ,w*) \= ->Liip, and hence 
(M e ,w*) ^ Liip. This proves the claim. 

Moore [flEf defined the notion of a stable expansion of a set A of formulas in the 
single-agent case. Intuitively, a stable expansion of A is a stable set containing A all 
of whose formulas can be justified, given A and the formulas believed in that stable 
set. Further discussion and justification of the notion of stable expansion can be 
found in [^[ Rather than discussing this here, we go directly to our multi-agent 
generalization of Moore's notion. 

Definition 6.5 Let A be a set of OA/"£ ra -formulas. T is called an i-stable expansion 
of A iff T = {7 E OAfC n I A U LiT U -L,r p 7}- 
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It is easy to see that an i-stable expansion is an i-stable set. The definition of z-stable 
expansions looks exactly like Moore's definition of stable expansions except that we 
again use e-consequence instead of tautological consequence. As in the case of stable 
sets, this is necessary to capture the fact that it is common knowledge that all agents 
can do reasoning under the extended canonical model semantics. 

We now generalize a result of Levesque's juj (who proved it for the single-agent 
case), showing that the z-stable expansions of a formula a correspond precisely to the 
different situations where i only knows a. We first need a lemma. 

Lemma 6.6 Let (M e ,w) be a situation with 

E = {L a I (M e ,w)\=L i 'y} U {-L i7 | (M e ,w)^L zl }- 

For any a, there is an i-objective formula a* such that 

(a) Spa» a*, 

(b) (M e , w) \= (L,a L t a*) A (N.a & N t a*). 

Proof Given a formula ip, we say that a subformula Liip of tp occurs at top level if 
it is not in the scope of any modal operators. Let a* be the result of replacing each 
top-level subformula of a of the form L i7 (resp., Ntf) by true if E \= e Lj 7 (resp., 
E \= e Ni"f) and by false otherwise. Clearly a* is i-objective. Moreover, a trivial 
argument by induction on the structure of a shows that E (= a a*: If a is a 
primitive proposition then a* — a; if a is of the form a\ A cti or ->a', then the result 
follows easily by the induction hypothesis; if a is of the form Lj(3 for j ^ i, then 
a = a*, since a has no top-level subformulas of the form Li<p\ finally, if a is of the 
form Li/3, then a* is either true or false, depending on whether Lj/3 is in E. Since 
either Lij3 or ->Li[] must be in E, the result is immediate in this case too. Part (b) 
follows immediately from part (a), since if w' «j w, we must have (M e ,w') \= E, so 
(M e ,w') ^a^a*. 

Theorem 6.7 Let w be a world in the extended canonical model and let F be the 
i-epistemic state corresponding to {M e ,w). Then, for every OA/"£ n -formula a, we 
have that (M e ,w)\=Oia iff (a) F is an i-stable expansion of {a} and (b) JC^(w) and 
M^{w) are disjoint. 

Proof Let E = LiTU^LiT. To prove the "only if " direction, suppose (M e , w)\=OiO>. 
The disjointness of K.f (w) and Aff (w) follows immediately from the fact that (M e , w)\=LiaA 
Ni~ia. To prove that T is an i-stable expansion of {a}, it suffices to show that for all 
a/V"£„-formulas /3, we have (M e , w)\=L { p iff {a} U E |= e /?. 

First suppose that {a} U E |= e j3. Since (M e ,w)\={OiCt} U E, and every for- 
mula in E is of the form Lij or ->Li7, it easily follows that (M e ,w) |=L»a and 
(M e ,w)|=L 4 E. Hence, (A/ e , w')\=a and (M e , w')h s for every w' G K.f{w). It follows 
that (M e ,w')\=f3 and, therefore, (M e , w)\=Li/3. 

For the converse, suppose that (M e , iy)|=Lj/3. We want to show that {a}UE \= e (3. 
By Lemma pM, we can assume without loss of generality that (3 is i-objective. (For 
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if not, we can replace (3 by an «-objective (3* such that E |= e (3 (3* and (M e , w) \= 
Li(3 ^ Li/3*, prove the result for (3*, and conclude that it holds for (3 as well.) To show 
that {a} U £ ^= e (3, we must show that for all worlds w' such that (M e , w')\={a} U E, 
we have (M e , u/) |= /3. By Lemma |6.6| , there is an i-objective formula a* such that 
(M e ,w) |= Oa ^ Oa* and E |= e a 4=> a*. Thus, (M e ,u>) |= N z a* A L 2 /3. By the 
arguments of Lemma |3. 14 (which apply without change to the extended canonical 
model semantics), it must be the case that |= e a* (3. Since £ ^ e a <^> a*, it 
follows that {a} US ^ e /?. Since (M e , w')^{a} U S by assumption, we have that 
(M e ,u/)|=/3, as desired. 

To prove the "if" direction of the theorem, suppose that ICf(w) and N^(w) are 
disjoint and that for all CW"£„-formulas f3, we have (M e , w)\=Li(3 iff {a} U E \= e (3. 
We need to show that (M e , w)|=Oia, that is, (M e , w)|=L 4 a A ATj-ia. 

Since {a} US ^ e a, the fact that (M e , w)\=Lia follows immediately. To prove 
that (M e , w)\=Ni-ia, let w' G Mf{w) and assume, to the contrary, that (M e ,w')\=a. 
Since £ Afl(w), it follows that E C w'. Hence u;/Li C w', from which u>' G /Cf (w) 
follows, contradicting the assumption that K,\ (w) and Nf(w) are disjoint. 



7 Conclusion 

We have provided three semantics for multi-agent only-knowing. All agree on the 
subset OAf£~, but they differ on formulas involving nested iVj's. Although a case 
can be made that the \= e semantics comes closest to capturing our intuitions for 
"knowing at most", our intuitions beyond ONC~ are not well grounded. It would 
certainly help to have more compelling semantics corresponding to AX'. 

On the other hand, it can be argued that semantics does not play quite as crucial 
a role when dealing with knowing at most as in other cases. The reason is that 
the structures we must deal with, in general, have uncountably many worlds. For 
example, whichever of the three semantics we use, there must be uncountably many 
worlds i-accessible from a situation (M, w) satisfying 0;p, at least one for every i-set 
that includes p. To the extent that we are interested in proof theory, the proof theory 
associated with |= e , characterized by the axiom system AX', seems quite natural. 
The fact that the validity problem is no harder in this setting than that for K45„ 
adds further support to its usefulness. Of course, as we suggested above, rather 
than only knowing, it seems more appropriate to reason about only knowing about 
a certain topic. Lakemeyer [T^| provides a semantics for only knowing about, using 
the canonical-model approach. It would be interesting to see if this can also be done 
using the other approaches we have explored here. 
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